I am working with an existing SharePoint deployment that has a convoluted security structure. After cleaning up permissions a bit, an approval workflow for absence requests is somehow not working for normal users. If a user with full control fills out a request, the workflow runs normally. However, if a user with Read & Add Only access generates one, the workflow fails with an "Access Denied" entry in the history.

I'm 99% sure that this is a permissions issue. All lists (workflow history and tasks included) have the same permissons now as indicated above. The System Account (the account the history entries are stamped with) has Limited Access permissons only but I wouldn't think that even a Full Control user would work if the problem was there. What other resources does workflow touch that might cause this?

Description: The workflow could not update the item, possibly because one or more columns for the item require a different type of information.
  • Is this workflow UI constructed or is it programmed? Judged by the error, some of the columns doesn't seem to receive the correct type of data. Like trying to put a string into a numbers only field.
    – user2536
    Commented Jul 2, 2012 at 18:14
  • The workflow calls for the Title column (single line of text) to be populated with the contents of a People Picker field formatted as Display Name. Title column is set to optional in the content type.
    – Toadmyster
    Commented Jul 2, 2012 at 21:22
  • Ah. It appears that a workflow operates (at least on list items) under the credentials of the user who initiated it. Does that sound right? When I remove Add Only and add Contribute it works fine.
    – Toadmyster
    Commented Jul 2, 2012 at 22:11
  • Visual Studio based workflow will run under the System Account and SharePoint Designer based workflow will run under the person who triggers it but you can elevate the step by using Impersonation Commented Jul 3, 2012 at 8:03
  • Thanks, Agamand. I found this link on this thread to verify. I will have to look up how to impersonate.
    – Toadmyster
    Commented Jul 3, 2012 at 23:07

1 Answer 1


Run it with elevated privileges like this:

    using (SPSite site = new SPSite(baseUrl))
        using (SPWeb web = site.OpenWeb())
            SPList list = web.Lists["Documents"];
            Microsoft.SharePoint.WorkflowServices.WorkflowServicesManager wsm = new Microsoft.SharePoint.WorkflowServices.WorkflowServicesManager(web);
            Microsoft.SharePoint.WorkflowServices.WorkflowInstanceService service = wsm.GetWorkflowInstanceService();

            //note:  There can be only 1 running workflow per item
            var instances = service.EnumerateInstancesForListItem(gPageList, pageID);
            foreach (var instance in instances)
                if (instance.Id == gWorkflowInstanceId)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.